Abu Dhabi Police Warn UAE Businesses of Supplier Payment Fraud

Abu Dhabi Police have issued a warning to businesses across the UAE after highlighting a fraud method in which criminals impersonate legitimate suppliers and business partners to redirect company payments into fraudulent bank accounts.

The warning, reported on 8 October 2026, concerns fake emails that appear to originate from established commercial contacts. Fraudsters request changes to bank details, often while genuine payments or outstanding invoices are being processed.

According to Abu Dhabi Police, criminals exploit existing business correspondence to make these requests appear authentic. In some cases, the deception is only discovered after funds have already been transferred, exposing companies to potentially significant financial losses.

The warning highlights a particular vulnerability in business payment processes: a transaction can be properly authorised internally while still being directed to an account controlled by a fraudster.

For organisations operating in the UAE, the incident reinforces the importance of independently verifying payment instructions, protecting commercial communications and ensuring that financial controls account for supplier impersonation.

How Supplier Payment Fraud Works

Supplier payment fraud, often associated with business email compromise, involves criminals attempting to divert legitimate business payments by impersonating an authorised recipient.

Rather than persuading a company to make an entirely unfamiliar payment, fraudsters may intervene in an existing commercial relationship.

A business might already be expecting an invoice from a supplier. The payment amount may be correct, the invoice reference familiar and the correspondence consistent with previous communications.

The fraudulent element is the destination of the payment.

An email claiming to represent the supplier may advise that its bank account has changed and request that outstanding funds be transferred to the replacement account.

The message may contain convincing branding, familiar names or details relating to a genuine transaction.

Criminals can carry out this deception using email addresses that closely resemble legitimate domains. In other cases, an email account may have been compromised, allowing fraudulent instructions to appear within an established correspondence chain.

Abu Dhabi Police have specifically warned companies against relying solely on emailed requests to change beneficiary account details.

The fact that a message appears to come from a recognised contact does not necessarily establish that its instructions are genuine.

Why Established Business Relationships Can Be Targeted

One of the difficulties with supplier payment fraud is that the underlying commercial relationship may be completely legitimate.

The supplier exists, the services have been delivered and the invoice is expected.

This makes the fraudulent request different from an unsolicited investment proposal or an unfamiliar payment demand.

Finance teams may regard the correspondence as routine because they recognise the supplier and understand why payment is due.

Criminals exploit that familiarity.

A request to amend bank details may be presented as an administrative change, banking update or temporary payment arrangement.

Where a business handles substantial numbers of supplier payments, even a small number of successfully redirected transactions can result in significant losses.

International trading relationships can introduce additional complications.

Companies operating across the UAE and overseas may regularly deal with different currencies, jurisdictions and banking arrangements. A request involving an unfamiliar financial institution may therefore not immediately appear unusual.

This makes independent verification particularly important, especially when a request changes an established payment destination.

What Abu Dhabi Police Have Advised

Abu Dhabi Police have urged businesses to take precautions before authorising transfers involving changes to beneficiary bank details.

Their warning emphasises the need to verify the authenticity of such requests directly with the relevant organisation through official and approved communication channels.

Companies should not assume that a request is genuine simply because it appears within existing email correspondence.

Practical safeguards include:

• Contacting suppliers through telephone numbers or communication channels already verified and held on file.
• Requiring independent confirmation before changing beneficiary bank details.
• Checking whether an email address matches the supplier's established domain.
• Reviewing unexpected changes to payment arrangements.
• Ensuring that employees responsible for payments understand common impersonation techniques.
• Escalating suspicious instructions before funds are released.
• Maintaining clear records of verification and payment approvals.

These precautions can help reduce exposure to fraudulent payment requests.

However, effective controls must also be consistently applied. A verification procedure offers limited protection if employees bypass it when a payment is urgent or appears routine.

Why Email Security Alone May Not Be Enough

Supplier impersonation demonstrates why organisations should consider both technical cyber security and financial approval procedures.

Email security systems can help identify malicious messages, suspicious domains and unauthorised account activity.

However, the financial consequences of a compromise may depend on how a business handles subsequent payment instructions.

If a fraudulent email reaches an employee who has authority to amend bank details, weaknesses in internal approval procedures may allow the deception to succeed.

Equally, a technically secure email account does not guarantee that every message received from an external party is legitimate.

Businesses therefore need to consider how digital communications connect with financial decision-making.

Conflict Advisory Group provides Cyber Security Services to support organisations in assessing vulnerabilities, strengthening digital defences and preparing for security incidents.

In the context of supplier payment fraud, the relevant concern extends beyond the email itself to the procedures used to verify information before money is transferred.

The Importance of Supplier Verification

Supplier relationships are an essential part of business operations, but organisations may become less cautious as those relationships become established.

A supplier that has operated reliably for several years may be regarded as low risk.

Nevertheless, a genuine supplier's identity can be impersonated, and its communications may be compromised without the supplier necessarily being involved in wrongdoing.

This is why supplier verification should not end when a commercial relationship begins.

Businesses should maintain accurate records of authorised contacts, agreed payment arrangements and relevant company information.

Where a supplier requests significant changes to its banking or ownership details, additional verification may be appropriate.

This is particularly relevant when dealing with overseas suppliers, intermediaries or complex corporate structures.

Independent Due Diligence can help organisations establish the identity, ownership and commercial background of counterparties where wider concerns exist.

However, corporate due diligence and payment authentication serve different purposes. Even a thoroughly verified supplier can be impersonated, making transaction-specific confirmation essential.

What Businesses Should Do if a Payment Has Been Redirected

Where a company suspects that funds have been transferred following a fraudulent payment instruction, prompt action can be important.

The business should contact its bank immediately, explain the suspected fraud and request that available payment tracing or recall procedures be considered.

Whether funds can be frozen or recovered depends on the circumstances, including the receiving institution, transaction status and applicable legal procedures.

Relevant correspondence and records should also be preserved.

These may include:

• The original invoice and any subsequent amendments.
• Emails requesting a change of bank account.
• Complete email headers and relevant account-access information.
• Transaction confirmations and beneficiary details.
• Records of internal payment authorisation.
• Supplier communications confirming the genuine payment arrangements.
• Any associated company or contact information.

Businesses should avoid deleting suspicious messages or making unnecessary changes to potentially relevant evidence before appropriate preservation measures have been considered.

If an email account may have been compromised, technical containment and credential-security measures may also be necessary.

Suspected fraud should be reported promptly to the appropriate authorities.

What the Warning Means for UAE Corporate Risk Management

The latest warning illustrates how financial fraud can exploit weaknesses across several parts of a business simultaneously.

A criminal may use digital impersonation to create the fraudulent instruction, familiarity with supplier arrangements to make the request credible and weaknesses in payment controls to complete the diversion.

None of these elements necessarily operates independently.

Consequently, businesses should consider supplier payment fraud as both a cyber security concern and an operational risk.

Financial approval procedures, staff awareness, supplier management and technical controls all contribute to an organisation's ability to identify suspicious activity.

The broader importance of verifying payment arrangements is also evident in recent UAE financial crime cases.

Our article, Stolen Cards Used to Pay Genuine GCC Bills: How Fraud Can Hide Behind Legitimate Transactions, examines a different scheme in which apparently legitimate payments formed part of wider fraudulent activity.

Although the methods differ, both examples demonstrate that the apparent legitimacy of a transaction should not replace verification of the people, accounts and instructions involved.

For UAE businesses, the immediate lesson is straightforward: an unexpected change to established payment details should trigger independent confirmation, regardless of how convincing the accompanying correspondence appears.

How Conflict Advisory Group Can Assist

Conflict Advisory Group supports organisations across the UAE with cyber security, corporate intelligence, due diligence and risk advisory services.

Where businesses face concerns involving suspicious commercial relationships, supplier impersonation or potential financial misconduct, establishing the facts and understanding the wider risk exposure can be important.

Depending on the circumstances, support may include reviewing relevant corporate relationships, examining available information about counterparties, assessing cyber security vulnerabilities and helping organisations understand the circumstances surrounding a suspected incident.

The appropriate response depends on the nature of the concerns, the available evidence and the legal requirements relevant to the matter.

Businesses should not assume that transferred funds can always be recovered. Early preservation of information and appropriate engagement with banks and authorities can nevertheless help inform the next steps.

Discuss a Corporate Fraud or Cyber Security Concern

If your organisation has received suspicious payment instructions, identified concerns involving a commercial counterparty or requires support assessing cyber and financial risks, Conflict Advisory Group can discuss your requirements confidentially.

Contact Conflict Advisory Group to discuss how we may be able to assist.